Is it ok to "--force-renewal" every months?

[jvanasco]

Explaining the differences mentioned above for the next person to read this thread:

1. By default, Certbot runs a cronjob every day. It only renews the Certificates that exceed the renew time (with a default of 60 days). In the future this will be based on the Automatic Renewal Information payloads.

2. --force-renewal will tell certbot to force a renewal regardless of the expiry date. You can certainly run that every 30 days to force new certificates, but if it fails you will not be able to recover automatically until the next invocation. You can not run this daily, because that will break rate limits.

3. So the standard solution for this situation is what @9peppe and @rg305 mentioned above:

@9peppe

Running that cron every 30 days is a good way not to know if you have a valid certificate.

A renewal can fail for transient reasons beyond your control. Trying twice a day letting certbot decide if a renewal is warranted or not is the proper way to do this.

You don't want to wait another 30 days to retry.

@rg305

Then make the automatic renewal period 45 days.

[sblantipodi]

thank you very much for the explanation, this is much appreciated.